WordPress remains one of the most widely used content management platforms, powering websites across businesses, media organizations, e-commerce, and public services. Its widespread adoption also makes vulnerabilities in the platform attractive targets for cybercriminals. A weakness in the WordPress core upgrade process has now drawn significant attention after attackers launched more than 240,000 attempts to exploit it. If successfully abused, the vulnerability could allow unauthenticated attackers to execute malicious code and gain control over vulnerable websites.
As per a report published by Cybersecurity News on November 6, 2026, citing analysis from Wordfence, attackers began targeting the WordPress core vulnerability CVE-2026-119977 on October 28, 2026, the same day WordPress released a security update addressing the issue. The vulnerability carries a CVSS score of 8.1 and affects unpatched WordPress versions from 4.7 through 7.1.3. The flaw involves predictable, publicly accessible temporary directories created during full WordPress core upgrades, potentially exposing installation files that attackers can exploit to achieve remote code execution without requiring a WordPress account.
CVE-2026-119977 is a vulnerability in the WordPress core upgrade process. It is associated with a time-of-check to time-of-use (TOCTOU) race condition, where an attacker attempts to access a resource during a brief period when it is available but should not be externally accessible.
During a full WordPress upgrade, installation files are extracted into a temporary directory under:
/wp-content/upgrade/
On vulnerable installations, the temporary directory can have a predictable name. If the directory and its installation files are accessible through web requests while the upgrade is in progress, an attacker may be able to locate and interact with the temporary installer.
The critical issue is the timing. The attacker must reach the exposed installation files before WordPress completes the upgrade and removes the temporary directory. This creates a limited exploitation window, but repeated automated requests can increase the likelihood of finding an installation during that period.
The vulnerability does not require an existing WordPress account or user interaction, making exposed and unpatched installations particularly important to identify.
The reported attack technique involves identifying exposed temporary upgrade directories and attempting to access the installer before cleanup occurs.
During a full upgrade, WordPress creates temporary installation directories beneath /wp-content/upgrade/. Vulnerable installations may expose predictable directory names, allowing attackers to construct requests targeting those locations.
Attackers send HTTP requests to installer files inside the exposed directories. One of the observed targets was:
/wp-content/upgrade/wordpress-6.9.11/wp-admin/setup-config.php
The objective is to reach the installation process while the temporary files remain available.
The attacker must access the installer during the short period between the creation of the temporary upgrade files and their removal. If cleanup happens first, the attempt fails.
This timing dependency is what makes the vulnerability a race condition rather than a straightforward, continuously available remote entry point.
According to the reported Wordfence analysis, successful access to the exposed installer could allow an attacker to complete a staged installation and create an administrator account.
With administrative access, an attacker could upload malicious PHP code and potentially establish backdoors, modify website content, or access sensitive information.
Potential exploitation sequence:
Predictable upgrade directory → Publicly accessible installer → Race-condition exploitation → Unauthorized administrator account → Malicious PHP upload → Website compromise
It is important to distinguish attempted exploitation from confirmed compromise. The reported 240,000 requests represent attack traffic, not 240,000 successfully infected websites.
The scale of the campaign demonstrates how quickly attackers can operationalize a newly disclosed vulnerability.
According to the reported Wordfence analysis, attack activity began on October 28, 2026, and increased significantly over the following days.
One of the most notable periods was October 30, when Wordfence’s firewall blocked more than 74,000 requests targeting the vulnerability.
Attack activity | Reported details |
Vulnerability | CVE-2026-119977 |
CVSS severity | 8.1 High |
Attack activity began | October 28, 2026 |
Total reported attempts | More than 240,000 |
Peak activity | October 30, 2026 |
Requests blocked on peak day | More than 74,000 |
Most active period | October 29 to November 1, 2026 |
Authentication requirement | None |
Potential impact | Remote code execution |
These figures highlight the speed at which automated exploitation can begin following vulnerability disclosure. However, blocked requests do not establish successful exploitation, persistent access, or the number of affected websites.
For website administrators, the key concern is whether their WordPress installation was vulnerable during the period of active exploitation and whether suspicious requests reached the temporary upgrade directories.
The reported analysis identified several IP addresses associated with exploit traffic, along with request paths and filenames that administrators can use when reviewing web server logs.
Reported IP addresses:
Indicator | Type |
103.59.160[.]171 | IPv4 |
51.89.103[.]78 | IPv4 |
185.177.72[.]61 | IPv4 |
195.3.220[.]7 | IPv4 |
96.62.218[.]148 | IPv4 |
20.217.186[.]29 | IPv4 |
87.58.197[.]83 | IPv4 |
154.26.238[.]8 | IPv4 |
20.46.43[.]126 | IPv4 |
Relevant paths and filenames:
These indicators can support retrospective investigation, but IP addresses may change or be reused. Organizations should correlate them with request patterns, timestamps, server activity, and evidence of unauthorized changes rather than treating an IP match alone as proof of compromise.
WordPress websites frequently support customer portals, online transactions, publishing platforms, marketing operations, and business communications. A successful compromise can therefore affect more than website availability.
Unauthorized administrator access: Attackers who create unauthorized administrator accounts may gain persistent control over website settings, users, and content.
Malicious PHP execution: Uploaded PHP backdoors can provide attackers with a way to execute commands or maintain access to the compromised website.
Website defacement and content manipulation: Attackers may modify pages, inject malicious content, or redirect visitors to fraudulent websites.
Data exposure: Depending on the website’s configuration and stored information, unauthorized access may expose customer details, account information, or other sensitive data.
Further compromise: A compromised website may be used to host malicious files, distribute malware, or serve as an entry point for additional attacks.
The risk is particularly significant for organizations running multiple WordPress websites or managing large numbers of installations through shared hosting and centralized administration environments.
WordPress administrators should prioritize patching and review their upgrade configurations to reduce exposure.
WordPress addressed the vulnerability in its October 28, 2026 security release. Administrators should upgrade to WordPress 7.1.4 or the corresponding patched release for their supported branch.
Older branches also received backported fixes. Organizations should verify the installed version rather than assuming that automatic background updates completed successfully.
The reported Wordfence guidance recommends blocking public access to PHP files beneath:
/wp-content/upgrade/
This protection is particularly important before updating a vulnerable installation. Wordfence notes that its recommended protection requires Extended Protection mode because staged PHP files may execute outside normal WordPress loading.
Administrators should examine HTTP access logs for unusual requests targeting /wp-content/upgrade/ and setup-config.php.
Repeated requests from unfamiliar IP addresses, particularly during upgrade windows, may warrant further investigation.
Review WordPress administrator accounts for unexpected additions, unfamiliar usernames, or changes in privileges. Remove unauthorized accounts and investigate how they were created.
Look for unexpected PHP files, recently modified scripts, unfamiliar plugins, and suspicious changes within WordPress directories. Pay particular attention to files that could provide persistent remote access.
Keep tested backups of website files and databases. Monitor changes to core files, plugins, themes, and administrative configurations to identify unauthorized modifications quickly.
The WordPress vulnerability highlights why web application security must be supported by continuous monitoring across servers, endpoints, network infrastructure, and cloud environments. Patching addresses the underlying weakness, but organizations also need visibility into suspicious requests, unauthorized access, and post-exploitation activity.
Seceon’s AI-driven cybersecurity capabilities can support this broader defense strategy.
Seceon aiSIEM can help organizations collect and correlate logs from web servers, firewalls, authentication systems, and other integrated security sources.
For WordPress environments, this visibility can support investigations into repeated requests targeting vulnerable upgrade paths, unusual administrator activity, suspicious login attempts, and unexpected changes in website behavior.
By correlating events across multiple sources, security teams can investigate whether suspicious web traffic is connected to broader activity within the organization’s infrastructure.
Seceon aiXDR-PMax provides endpoint threat detection and investigation capabilities. Where appropriate endpoint telemetry is available, it can help identify suspicious process execution, malicious files, and other behavior associated with post-compromise activity.
This can be valuable when attackers move beyond exploiting a website and attempt to execute malicious code or establish persistence on the underlying server.
Organizations hosting WordPress websites in cloud environments must also monitor the infrastructure supporting those applications. Seceon aiSIEM-CGuard can support security visibility across integrated cloud environments and help investigate suspicious activity involving connected resources.
Internet-facing WordPress installations can become attractive targets when they run outdated software or expose unnecessary services. Seceon aiSecurityScore360 can support external attack surface and security posture assessments, helping organizations identify exposure that requires attention.
This complements vulnerability management and patching by providing visibility into externally exposed assets.
Together, these capabilities can help security teams improve detection, investigation, and exposure management. They complement WordPress updates, secure server configuration, web application protection, and regular application security assessments rather than replacing them.
The campaign involving more than 240,000 WordPress exploit attempts demonstrates how quickly attackers can target a newly disclosed vulnerability. CVE-2026-119977 is particularly concerning because it can potentially enable unauthenticated remote code execution through a race condition in the WordPress core upgrade process.
Although successful exploitation requires access to temporary installation files during a limited window, the volume of automated requests shows why organizations cannot rely on the assumption that a short-lived exposure will go unnoticed.
WordPress administrators should install the appropriate security update, restrict public access to temporary upgrade PHP files, review server logs, and investigate unexpected administrator accounts or file changes.
For businesses that depend on WordPress for customer engagement and digital operations, website security must extend beyond routine patching. Continuous monitoring, endpoint visibility, attack surface management, and coordinated incident investigation are essential to identifying threats before a vulnerable website becomes a gateway to broader compromise.
